Privacy Policy

• Parent account: email address, display name, password (stored hashed by our authentication provider), and sign-in metadata.
• Device and session records: a device identifier, browser user agent, and last-seen time, used to detect account sharing and to let you sign out other devices.
• Child profiles: first name, grade level, avatar color, optional profile photo.
• Tutoring content: uploaded homework files and typed problems, the tutoring conversation, question/hint counters, and safety-refusal records.
• Voice interaction: live audio streamed during a voice tutoring call.
• Billing: subscription status, plan, quantity, and Stripe customer / subscription identifiers. Card details are handled by Stripe and never reach our servers.
• Support messages: name, email, and message when you use the contact form.

We do not sell personal information. We do not display advertising. The application does not include third-party advertising or analytics trackers such as Google Analytics, Meta Pixel, or similar. Web fonts are currently loaded from Google Fonts, which means your browser contacts Google's font servers when a page loads.

• Supabase (via Lovable Cloud) — database, authentication, and file storage for accounts, profiles, homework files, and session records.
• Google Gemini (via the Lovable AI gateway) — reads uploaded homework and generates coaching responses.
• Retell AI — powers voice tutoring. Receives the child's first name, grade level, subject, transcribed homework text, and live audio during a call.
• Stripe — subscription billing and payment processing.
• Email delivery — transactional and authentication emails to the parent's address.

Pending vendor confirmation: Retell AI's recording, transcription, retention, subprocessor, and deletion terms have not yet been confirmed in writing, and Tiny Tutors has no automated mechanism to request deletion of data held by Retell. We make no representation about that vendor's retention or deletion behaviour until it is documented.

• Session data (homework files, tutoring conversation, temporary AI context, problem text) is deleted when a session ends, and by a scheduled server-side job for sessions that are abandoned.
• Child profiles (name, grade, avatar) persist until a parent deletes them, so profiles don't have to be recreated each day.
• Aggregate progress counters (session length, subject, solved counts) are retained for the parent progress view.
• Account, device, subscription, and billing records are retained while the account is active and as needed for accounting and dispute resolution.

Parents can withdraw consent for a child, permanently delete a child profile and its stored files, sign out other devices, and manage or cancel a subscription from the billing portal. To request deletion of your parent account, email support@bibanga.com.

Access to data is enforced at the database level with row-level security so a parent can only reach their own account, children, sessions, and files. Server-side authorization is re-checked on every privileged operation. Service credentials are held server-side only and are never exposed to the browser.

Bibanga LLC — support@bibanga.com. For questions specific to a child's information, use "Children's privacy" in the subject line.